Recovering Small Files from SSDs

G5 Cyber Security

1 week ago

TL;DR

Recovering small deleted files from an SSD is harder than with a traditional hard drive due to how SSDs work. File recovery tools can sometimes recover them, but success isn’t guaranteed. TRIM and wear levelling are the biggest obstacles. The sooner you try after deletion, the better your chances.

Understanding the Problem

When you delete a file on an SSD, it’s not immediately erased like on a traditional hard drive. Instead, the space is marked as available for new data. However, SSDs use technologies that make recovery more difficult:

TRIM: This command tells the SSD to physically erase blocks of data that are no longer in use. If TRIM has run on the blocks where your deleted file was stored, recovery is almost impossible.
Wear Levelling: SSDs distribute writes across all memory cells to prolong their lifespan. This means a file’s fragments might be scattered across different locations, making reconstruction harder.

NTFS Master File Table (MFT) records point to the location of files on the drive. When a file is deleted, the MFT entry is marked as unused but isn’t immediately overwritten. Recovery tools attempt to find these entries.

Steps to Recover Deleted Small Files

Stop Using the Drive: Immediately stop writing any new data to the SSD. This prevents overwriting the deleted file’s space, increasing recovery chances.
Choose a File Recovery Tool: Several tools can help. Popular options include:
- Recuva (Free/Paid): User-friendly and effective for basic recovery.
- TestDisk & PhotoRec (Free): Powerful, open-source tools; more complex to use. PhotoRec is particularly good at recovering file types even without a filesystem.
- EaseUS Data Recovery Wizard (Paid): Commercial software with advanced features.
- Disk Drill (Paid): Another commercial option known for its ease of use and recovery capabilities.
Run the Recovery Tool: The process varies slightly depending on the tool, but generally follows these steps:
1. Select the SSD: Choose the drive where the file was deleted from the list of available drives.
2. Scan for Deleted Files: Start a scan. Most tools offer both quick and deep scans. Start with a quick scan first, as it’s faster. If that doesn’t find your files, try a deep scan (this will take much longer).
3. Filter Results: After the scan, filter the results by file type, size, or date modified to narrow down the search. Since you are looking for small files, use the size filter.
4. Preview and Recover: Preview the recovered files (if possible) to ensure they’re what you want. Select the files and choose a different drive to save them to – do not save back onto the original SSD!
Check File Integrity: After recovery, verify that the recovered files are usable. Small files can sometimes be corrupted during the process.

Advanced Considerations

TRIM Status: Check if TRIM is enabled on your SSD. In Windows, open Command Prompt as administrator and run:
```
fsutil behavior query DisableDeleteNotify
```
If the result is DisableDeleteNotify = 0, TRIM is enabled. If it’s DisableDeleteNotify = 1, TRIM is disabled (better for recovery).
Secure Erase: Avoid using Secure Erase or other drive wiping tools as they permanently delete data.
File System Fragmentation: NTFS fragmentation can make recovery harder, especially on SSDs. However, modern SSDs handle fragmentation differently than traditional hard drives.

Why Small Files Are Harder to Recover

Small files are more vulnerable to being overwritten quickly because there’s less data involved. Also, the overhead of managing small allocations can sometimes lead to them being discarded sooner by the SSD’s internal processes.